Actions
Feature #6216
open
VJ
PA
http: HHHash support
Feature #6216:
http: HHHash support
Effort:
Difficulty:
Label:
Actions
Added by Victor Julien about 3 years ago. Updated 7 days ago.
Investigate as a plugin
We can easily enough do a plugin that registers a new logger for http1 (and also a new one for http2)
But this new logger will emit a new http event in addition to the current one emitted by the suricata http1 logger
And it will not add details to alert events
SCEveRunCallbacks is for all events
I think the best way forward may be to
- enhance EveJsonSimpleAppLayerLogger with other callbacks than LogTx and use them
- convert http1 protocol to EveJsonSimpleAppLayerLogger
- so maybe first solve https://redmine.openinfosecfoundation.org/issues/7696
Jason Ish wrote in #note-4:
Why as a plugin and not just built-in?
I think https://redmine.openinfosecfoundation.org/issues/6216#note-1 comes from a discussion with Victor
putting in feedback state to make this clear with him